Trust and security
Security
How Unfour handles local data, credentials, MCP permissions, Cloud Sync boundaries, release integrity, and private security reporting.
Local-first, not network-free
Unfour stores desktop workspace data locally by default. API requests, SSH sessions, and database operations are initiated by the local application and connect to the systems you choose. Core API, SSH, Database, and MCP features are free and open source.
MCP runs as a local stdio server through the same Unfour command bus as the desktop app. Tool results reach the connected client, which may use a remote AI provider. Review that client’s data policy before exposing operational data. Local execution does not mean that all data stays on your device.
Account sign-in, billing, updates, and optional Cloud Sync have online boundaries. Without enabling Cloud Sync, the app does not upload workspace records through that service; ordinary remote operations still use the network.
Credentials, local storage, and redaction
The production secret store uses operating-system backends: Windows credential storage, Apple Keychain, and Linux Secret Service. SSH passwords and key passphrases, database passwords, and desktop account sessions use this boundary. Saved SSH and database connections hold workspace-scoped credential references instead of copying these secrets into connection metadata.
This is not blanket encryption of the workspace. Saved API authentication, headers, bodies, and scripts can be stored in local SQLite; API auth is not automatically converted to keychain references. Workspace/environment variable values are also stored locally without encryption, including values marked secret. Protect local data and backups with your device’s access controls.
Sync snapshots exclude connection credentials and references, and omit values explicitly marked secret. API snapshots redact recognized authentication and sensitive field values. Logs, history, diagnostics, and MCP responses have scoped redaction or masking. These are rule-based protections, not a guarantee that arbitrary text contains no secrets: scripts, command templates, unrecognized fields, and non-JSON text need your review.
SSH records the host fingerprint on first use and rejects later mismatches. Verify the expected fingerprint independently when connecting to sensitive systems. No security audit or absolute protection is implied by these implementation details.
MCP workspace permissions
The local MCP adapter uses the Unfour command bus and workspace-scoped operations. The workspace MCP policy supports disabled, read_only, guarded, and full_access. With auto, dev resolves to full access, test to guarded, and prod to read-only. An explicit policy overrides auto: a prod label alone is not an unconditional write block.
Read-only policy blocks actions classified as writes or execution; guarded actions use confirmation where required. A CONFIRMATION_REQUIRED response includes confirmation_text bound to the proposed operation. Review the operation before retrying the same payload with confirm=true and that exact text. Confirmation does not bypass a policy block. Full access is not a promise that every risky operation prompts; backend SQL and other domain-specific checks still apply.
Use least-privilege server and database accounts as an additional boundary. MCP permissions and masking are implemented, and real Codex/Cursor client journeys are recorded, but v0.9.0 production-policy behavior in a real prod workspace remains NOT VERIFIED.
Optional Cloud Sync privacy
An active Pro entitlement unlocks Cloud Sync inside the same Unfour application. For enabled workspaces it can upload workspace metadata, API trees and saved requests, non-secret variables and environment definitions, shared connection fields, and SSH task definitions to the Unfour service.
Device-local UI and activity, runtime history/results, keychain credentials, connection credential references, private-key and local database paths are outside the supported payload. Secret-marked variable values are omitted, and recognized API secrets are redacted. Shared metadata and free text can still contain confidential information; review the detailed boundaries before enabling sync.
The v0.9.0 unified-client multi-device regression remains NOT VERIFIED, including its single-device coverage. Earlier live sync evidence and implemented recovery behavior are not a completed regression for this release. Creem Production checkout is also not recorded as verified; Creem Test evidence is a different scope.
Release integrity and platform trust
Use the official GitHub Release and its SHA256SUMS.txt to compare the checksum of the exact downloaded artifact. The current website release is 0.9.0. A checksum helps detect a changed download; it is not an operating-system publisher certificate.
Standard in-app updates use Tauri updater signatures. Updater signature verification is separate from Windows Authenticode and Apple code signing/notarization. Published signature files and a verified successful Stable upgrade do not establish manual rejection of an invalid signature; that rejection check remains NOT VERIFIED.
The Windows NSIS installer is not Authenticode-signed and may trigger SmartScreen. macOS packages are unsigned and unnotarized and may be blocked by Gatekeeper. Recorded Windows install/run and macOS arm64/x64 install/run checks are separate from SmartScreen/Gatekeeper trust behavior, which remains NOT VERIFIED for v0.9.0.
Linux x64 AppImage is published and downloadable but remains Experimental; launch, desktop integration, and updater behavior are NOT VERIFIED in a real Linux environment.
Report security issues privately
Use the repository’s private vulnerability reporting entry or the private contact in SECURITY.md. Do not put vulnerability details, credentials, or production data in a public issue.
Include the affected version, environment, impact, and safe reproduction steps. Consult SECURITY.md for current supported versions and disclosure guidance.